Privacy Policy

1. Who We Are

Zorthex Temporal Registry ("ZTR", "we", "us") is operated by Renato Santi, independent researcher and creator of the Zorthex™ framework. Contact: zorthex.official@gmail.com. Jurisdiction: Italy / European Union.

2. What We Collect

When you use the ZTR connector to verify a document, we collect and store:

• SHA-256 hash of the document text (64 characters). This is a one-way mathematical fingerprint — it cannot be reversed to recover the original document.
• Verification timestamp (ISO 8601 UTC) — the exact moment the verification was recorded.
• Your user identifier (email address) provided during authentication.
• Organisation identifier (optional) if provided during setup.
• Review note (optional) — any note you choose to add describing the verification performed.
• Review context — the type of review selected (e.g. legal_filing, contract_review).
• TSA token — the RFC 3161 timestamp response from Aruba PEC, when eIDAS-qualified timestamping is used.
• Verification status — whether the eIDAS timestamp was successfully obtained.

3. What We Never Collect

• The original document text or content
• Any file, attachment, or binary uploaded
• The contents of your Claude conversations
• Any personally identifiable information beyond your email address
• Payment information (ZTR is currently free to use)

4. How We Use Your Data

The data we collect is used exclusively to:

• Generate and store your verification receipt
• Allow you to retrieve receipts you have created
• Provide a record of verification activity for your organisation
• Obtain eIDAS-qualified timestamps from Aruba PEC (the hash is transmitted to Aruba's TSA endpoint for this purpose)

We do not use your data for advertising, profiling, model training, or any purpose other than providing the verification service.

5. Third-Party Services

Aruba PEC S.p.A. — When eIDAS-qualified timestamping is used, the SHA-256 hash of your document (not the document itself) is transmitted to Aruba PEC's Qualified Trust Service Provider endpoint (servizi.arubapec.it) to obtain an RFC 3161 timestamp. Aruba PEC is a Qualified Trust Service Provider under eIDAS Regulation (EU) 910/2014. Their timestamp tokens are archived for 30 years. Aruba's privacy policy: aruba.it/privacy.

No other third-party services receive your data.

6. Data Retention

Verification receipts are retained indefinitely to support the demonstrability purpose of the service — a receipt may need to be retrieved months or years after it was created to demonstrate that verification occurred at a specific time. If you wish to have your receipts deleted, contact us at zorthex.official@gmail.com.

7. Your Rights (GDPR)

As a resident of the European Union or European Economic Area, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Request restriction of processing
• Data portability — receive your receipts in machine-readable format
• Lodge a complaint with your national data protection authority

To exercise any of these rights, contact: zorthex.official@gmail.com

8. Security

All data is transmitted over HTTPS. The receipt database is stored on servers in the European Union. Access is authenticated via OAuth 2.0. The SHA-256 hashing is performed using Python's standard library hashlib module. HMAC-SHA256 integrity seals are applied to each receipt.

9. Changes to This Policy

We will update this page if our data practices change. The "last updated" date at the top of this page reflects the most recent revision.

10. Contact

Renato Santi · Zorthex™ · zorthex.official@gmail.com · temporalregistry.com